5 ms·

I suspected this was being managed in the Secure Enclave. That means it's going to be extremely difficult to disable this even if iOS is fully compromised.

karlgkk 2y ago
If I’m reading this right: Reboot is not enforced by the SEP, though, only requested. It’s a kernel module, which means if a kernel exploit is found, this could be stopped. However, considering Apple’s excellent track record on these kind of security measures, I would not at all be surprised to find out that a next generation iPhone would involve the SEP forcing a reboot without the kernels involvement. what this does is that it reduces the window (to three days) of time between when an iOS device is captured, and a usable* kernel exploit is developed. * there is almost certainly a known kernel exploit out in the wild, but the agencies that have it generally reserve using them until they really need to - or they’re patched. If you have a captured phone used in a, for example, low stakes insurance fraud case, it’s not at all worth revealing your ownership of a kernel exploit. Once an exploit is “burned”, they distribute them out to agencies and all affected devices are unlocked at once. This now means that kernel exploits must be deployed within three days, and it’s going to preserve the privacy of a lot of people.
- toomuchtodo 2y ago
  Would be nice if Apple would expose an option to set the timer to a shorter window, but still great work.
  - jojobas 2y ago
    Or to disable it entirely. Someone could set up and ipad to do something always plugged in, would be bloody annoying to have it locked cold every three days.
    - mjevans 2y ago
      I'd rather have a dedicated Kiosk mode that has a profile of allow-listed applications and one or more that are auto-started.
      - aspenmayer 2y ago
        Maybe one or two of these will do what you want? https://support.apple.com/en-us/105121 https://support.apple.com/en-us/105121 > With Screen Time, you can turn on Content & Privacy Restrictions to manage content, apps, and settings on your child's device. You can also restrict explicit content, purchases and downloads, and changes to privacy settings. https://support.apple.com/en-us/111795 https://support.apple.com/en-us/111795 > Guided Access limits your device to a single app and lets you control which features are available.
        duskwuff 2y ago
        Or "single-app mode", which is a more tightly focused kiosk mode: https://support.apple.com/guide/apple-configurator-mac/start-single-app-mode-cadbf9c172/mac https://support.apple.com/guide/apple-configurator-mac/start...
    - grahamj 2y ago
      Conspiracy theory time! Apple puts this out there to break iPad-based DIY home control panels because they're about to release a product that would compete with them.
      - aspenmayer 2y ago
        It’s more likely than you think! > Apple's Next Device Is an AI Wall Tablet for Home Control, Siri and Video Calls https://news.ycombinator.com/item?id=42119559 https://news.ycombinator.com/item?id=42119559 via > Apple's Tim Cook Has Ways to Cope with the Looming Trump Tariffs https://news.ycombinator.com/item?id=42168808 https://news.ycombinator.com/item?id=42168808
      - deleted 2y ago
        [deleted]
  - alwayslikethis 2y ago
    In GrapheneOS, you can set it to as little as 10 minutes, with the default being 18 hours. That would be a lot more effective for this type of data exfiltration scenario.
  - technics256 2y ago
    You can do this yourself with Shortcuts app. Create a timer function to run a shutdown on a time interval you order. Change shutdown to "restart".
    - KennyBlanken 2y ago
      You clearly haven't tried it or even googled it - because it's impossible to do it unattended. A dialog pops up (and only when unlocked) asking you to confirm the reboot. It's probably because they were worried users might end up in a constant reboot/shutdown cycle, though presumably they could just implement a "if rebooted in the last hour by a script, don't allow it again" rule.
- dmitrygr 2y ago
  > Reboot is not enforced by the SEP, though, only requested We (the public) do not know if SEP can control nRST of the main cores, but there is no reason to suspect that it cannot.
  - karlgkk 2y ago
    We actually do know, it cannot directly*. What it could do is functionally disable RAM, but that would basically cause the phone to hard lock and even cause data corruption in some limited cases. This is still being actively researched. I have no evidence, but would not be surprised to find out that a SEP update has been pushed that causes it to pull RAM keys after the kernel panic window has closed. * This may have been changed since the last major writeup came out for the iPhone 11.
    - dmitrygr 2y ago
      iPhone 11, the one 5 years ago? So yes, you have not at all refuted my statement for any recent phone
- grahamj 2y ago
  > Reboot is not enforced by the SEP, though, only requested. It’s a kernel module, which means if a kernel exploit is found, this could be stopped. True. I wonder if they've considered the SEP taking a more active role in filesystem decryption. If the kernel had to be reauthenticated periodically (think oauth's refresh token) maybe SEP could stop data exfiltration after the expiry even without a reboot. Maybe it would be too much of a bottleneck; interesting to think about though.
  - karlgkk 2y ago
    > If the kernel had to be reauthenticated periodically (think oauth's refresh token) If the kernel is compromised, this is pointless I think. You could just "fake it". SEP is already very active in filesystem encryption. The real important thing is evicting all sensitive information from memory. Reboot is the simplest and most effective, and the end result is the same.
    - grahamj 2y ago
      It’s involved in handling the keys but I don’t think disk is processed by the SEP. If it was the SEP could simply stop providing access.
- markasoftware 2y ago
  Kernel exploits would let someone bypass the lockscreen and access all the data they want immediately, unless I'm missing something. Why would you even need to disable the reboot timer in this case?
  - karlgkk 2y ago
    Hypotdthically, I suppose there's value in disabling the timer if you're, for example, waiting for a SEP exploit that only works if in an AFU state? But, I don't know where the idea of disabling a reboot timer came in? I'm only simply saying that now, you have to have a kernel exploit on hand, or expect to have one within three days - a very tall order indeed.
- KennyBlanken 2y ago
  > * there is almost certainly a known kernel exploit out in the wild, but the agencies that have it generally reserve using them until they really need to - or they’re patched. There's literally emails from police investigators spreading word about the reboots, which state that the device goes from them being able to extract data while in AFU, to them not being able to get anything out of the device in BFU state. It's a bit pointless, IMHO. All cops will do is make sure they have a search warrant lined up to start AFU extraction right away, or submit warrant requests with urgent/emergency status.
  - karlgkk 2y ago
    I sort addressed this in my original comment but local police likely do not have access to an AFU vuln, and generally get it after it’s been patched. Then, they go on an unlocking spree. This prevents that
- op00to 2y ago
  If reboot doesn’t happen kernel panics, at least that’s what the article says.
  - aaronmdjones 2y ago
    That's only because the kernel tells the userland to reboot. If the kernel is compromised, they can stop it from telling userland to reboot and stop the kernel panicing.

karlgkk 2y ago

If I’m reading this right: Reboot is not enforced by the SEP, though, only requested. It’s a kernel module, which means if a kernel exploit is found, this could be stopped. However, considering Apple’s excellent track record on these kind of security measures, I would not at all be surprised to find out that a next generation iPhone would involve the SEP forcing a reboot without the kernels involvement. what this does is that it reduces the window (to three days) of time between when an iOS device is captured, and a usable* kernel exploit is developed. * there is almost certainly a known kernel exploit out in the wild, but the agencies that have it generally reserve using them until they really need to - or they’re patched. If you have a captured phone used in a, for example, low stakes insurance fraud case, it’s not at all worth revealing your ownership of a kernel exploit. Once an exploit is “burned”, they distribute them out to agencies and all affected devices are unlocked at once. This now means that kernel exploits must be deployed within three days, and it’s going to preserve the privacy of a lot of people.

toomuchtodo 2y ago
Would be nice if Apple would expose an option to set the timer to a shorter window, but still great work.
- jojobas 2y ago
  Or to disable it entirely. Someone could set up and ipad to do something always plugged in, would be bloody annoying to have it locked cold every three days.
  - mjevans 2y ago
    I'd rather have a dedicated Kiosk mode that has a profile of allow-listed applications and one or more that are auto-started.
    - aspenmayer 2y ago
      Maybe one or two of these will do what you want? https://support.apple.com/en-us/105121 https://support.apple.com/en-us/105121 > With Screen Time, you can turn on Content & Privacy Restrictions to manage content, apps, and settings on your child's device. You can also restrict explicit content, purchases and downloads, and changes to privacy settings. https://support.apple.com/en-us/111795 https://support.apple.com/en-us/111795 > Guided Access limits your device to a single app and lets you control which features are available.
      - duskwuff 2y ago
        Or "single-app mode", which is a more tightly focused kiosk mode: https://support.apple.com/guide/apple-configurator-mac/start-single-app-mode-cadbf9c172/mac https://support.apple.com/guide/apple-configurator-mac/start...
  - grahamj 2y ago
    Conspiracy theory time! Apple puts this out there to break iPad-based DIY home control panels because they're about to release a product that would compete with them.
    - aspenmayer 2y ago
      It’s more likely than you think! > Apple's Next Device Is an AI Wall Tablet for Home Control, Siri and Video Calls https://news.ycombinator.com/item?id=42119559 https://news.ycombinator.com/item?id=42119559 via > Apple's Tim Cook Has Ways to Cope with the Looming Trump Tariffs https://news.ycombinator.com/item?id=42168808 https://news.ycombinator.com/item?id=42168808
    - deleted 2y ago
      [deleted]
- alwayslikethis 2y ago
  In GrapheneOS, you can set it to as little as 10 minutes, with the default being 18 hours. That would be a lot more effective for this type of data exfiltration scenario.
- technics256 2y ago
  You can do this yourself with Shortcuts app. Create a timer function to run a shutdown on a time interval you order. Change shutdown to "restart".
  - KennyBlanken 2y ago
    You clearly haven't tried it or even googled it - because it's impossible to do it unattended. A dialog pops up (and only when unlocked) asking you to confirm the reboot. It's probably because they were worried users might end up in a constant reboot/shutdown cycle, though presumably they could just implement a "if rebooted in the last hour by a script, don't allow it again" rule.
dmitrygr 2y ago
> Reboot is not enforced by the SEP, though, only requested We (the public) do not know if SEP can control nRST of the main cores, but there is no reason to suspect that it cannot.
- karlgkk 2y ago
  We actually do know, it cannot directly*. What it could do is functionally disable RAM, but that would basically cause the phone to hard lock and even cause data corruption in some limited cases. This is still being actively researched. I have no evidence, but would not be surprised to find out that a SEP update has been pushed that causes it to pull RAM keys after the kernel panic window has closed. * This may have been changed since the last major writeup came out for the iPhone 11.
  - dmitrygr 2y ago
    iPhone 11, the one 5 years ago? So yes, you have not at all refuted my statement for any recent phone
grahamj 2y ago
> Reboot is not enforced by the SEP, though, only requested. It’s a kernel module, which means if a kernel exploit is found, this could be stopped. True. I wonder if they've considered the SEP taking a more active role in filesystem decryption. If the kernel had to be reauthenticated periodically (think oauth's refresh token) maybe SEP could stop data exfiltration after the expiry even without a reboot. Maybe it would be too much of a bottleneck; interesting to think about though.
- karlgkk 2y ago
  > If the kernel had to be reauthenticated periodically (think oauth's refresh token) If the kernel is compromised, this is pointless I think. You could just "fake it". SEP is already very active in filesystem encryption. The real important thing is evicting all sensitive information from memory. Reboot is the simplest and most effective, and the end result is the same.
  - grahamj 2y ago
    It’s involved in handling the keys but I don’t think disk is processed by the SEP. If it was the SEP could simply stop providing access.
markasoftware 2y ago
Kernel exploits would let someone bypass the lockscreen and access all the data they want immediately, unless I'm missing something. Why would you even need to disable the reboot timer in this case?
- karlgkk 2y ago
  Hypotdthically, I suppose there's value in disabling the timer if you're, for example, waiting for a SEP exploit that only works if in an AFU state? But, I don't know where the idea of disabling a reboot timer came in? I'm only simply saying that now, you have to have a kernel exploit on hand, or expect to have one within three days - a very tall order indeed.
KennyBlanken 2y ago
> * there is almost certainly a known kernel exploit out in the wild, but the agencies that have it generally reserve using them until they really need to - or they’re patched. There's literally emails from police investigators spreading word about the reboots, which state that the device goes from them being able to extract data while in AFU, to them not being able to get anything out of the device in BFU state. It's a bit pointless, IMHO. All cops will do is make sure they have a search warrant lined up to start AFU extraction right away, or submit warrant requests with urgent/emergency status.
- karlgkk 2y ago
  I sort addressed this in my original comment but local police likely do not have access to an AFU vuln, and generally get it after it’s been patched. Then, they go on an unlocking spree. This prevents that
op00to 2y ago
If reboot doesn’t happen kernel panics, at least that’s what the article says.
- aaronmdjones 2y ago
  That's only because the kernel tells the userland to reboot. If the kernel is compromised, they can stop it from telling userland to reboot and stop the kernel panicing.